[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce:

1 The NICE Framework building block statements, Work Roles, and Competency Areas are made available online as part of the NICE Framework Resource Center in order to allow for regular review and updates [2].

5 The creation and maintenance of NICE Framework Competency Areas follows NIST practices of engaging with stakeholders in an open, transparent, and collaborative process that includes workshops and other opportunities to provide input. Information on how to engage with the NICE Framework, the revision process, and the current List of Competency Areas can be found in the NICE Framework Resource Center: https://www.nist.gov/nice/framework.

NICE Framework resources, including the latest list of Competency Areas, are available in the NICE Framework Resource Center. NIST is maintaining the Competency Areas list separate from this document and from the NICE Framework publication to allow for regular review and updates. The NICE Framework Resource Center also includes information on how to engage in and keep informed on updates and development of the NICE Framework and supporting resources.

NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services provide? (Part 5)

[Assistant]
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary................................................................................................................. 1   | Executive Summary................................................................................................................. 1   | Executive Summary................................................................................................................. 1   |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Introduction ......................................................................................................................

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities  include the development of management,  administrative,  technical,  and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800series  reports  on  ITL's  research,  guidelines,  and  outreach  efforts  in  information  system security, and its collaborative activities with industry, government, and academic organizations. | Executive Summary . . . . . . . . . . | Executive Summary . . . . . . . . . . | . . . . . . . . . . . | 1   |
|----------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1. Introduction . . . . . . . . . | 1. Introduction . . . . . . . . . | . . . . . . . . . . . . . . | 3   |
| 1.1. Document Purpose and Scope                                            | 1.1. Document Purpose and Scope                                                                                | . . . . . . . . . | 7   |
| 1.2. Intended Audience . . | 1.2. Intended Audience . . | . . . . . . . . . . . . . . | 7   |
| 1.3. Organization . . . . | 1.3. Organization . . . . | . . . . . . . . . . . . . . .

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

function of the adverse impacts that arise if the circumstance or event occurs, and the likelihood of occurrence. Types security and privacy risk (including supply chain risk); project risk; reputational risk; safety risk; strategic planning risk. 6  [OMB A-130] defines PII as 'information that can be used to distinguish or trace an individual's identity, either alone

The authorization boundary defines the system 36 for RMF execution to facilitate risk management and accountability. The system may be supported by one or more enabling systems that provide support during the system life cycle. Enabling systems are not contained within the authorization boundary of the system and do not necessarily exist in the system's environment of operation. An enabling system may provide common (i.e., inherited) controls for the system or may include any type of service or functionality used by the system such as identification and authentication services, network services, or monitoring functionality. Finally, there are other systems the system interacts with in the operational environment. The other systems are also outside of the authorization boundary and may be the beneficiaries of services provided by the system or may simply have some general interaction. 37

Discussion: Common controls are controls that can be inherited by one or more information systems. 60 Common controls can include controls from any [SP 800-53] control family, for example, physical and environmental protection controls, system boundary and monitoring controls, personnel security controls, policies and procedures, acquisition controls, account and identity management controls, audit log and accountability controls, or complaint management controls for receiving privacy inquiries from the public. Organizations identify and select the set of common controls and allocate those controls to the organizational entities designated as common control providers.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to Hardware Security Failure Scenarios_ Potential Hardware Weaknesses:

gions and perform both read and write by using memory alias addresses (i.e., redundant addresses that point to the same memory region) or mirrored memory regions that do not have the same protections.
An attacker could possibly create memory address aliases to perform such an attack [CWE-1257]. 9. Lower privilege software can write to memory regions for higher privileged software due to overlapping memory regions, thus enabling malicious software to perform privilege escalation or a DoS attack [CWE-1260].

Hardware Security Failure Scenarios_ Potential Hardware Weaknesses


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

'We depend on pulling in other resources to help with [the security awareness program], and that, again, goes back to being tied to the threat team and to the policy team.' (D03)

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 2 requirements?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

<!-- image -->

## NIST Special Publication 800 NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171Ar3

<!-- image -->

## NIST Special Publication

## NIST SP 800-171Ar3

## Assessing Security Requirements for Controlled Unclassified Information

Ron Ross Victoria Pillitteri Computer Security Division

Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-171Ar3

May 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.7 (NIST 3.1.7)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.1.7. 3.1.7): Proof of possession

and control via an authentication protocol of a cryptographic key held by the
subscriber that requires activation by a second authentication factor

2. 3.1.7)

When a combination of two single-factor authenticators is used, the combination  SHALL
include one physical authenticator (i.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. that and now have automated tools…Our onboarding site is a self-registration site so that our new staff can go and self-register, take their training, and then that ties into our primary learning center once they're on board and approved. We reconcile those transcripts. So, we do have now the automated means where we do tie it into our backend account management system so that, truly, people aren't getting access to things before they've taken that training and signed the rules of behavior.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

An information system 'is a set of interacting elements that are organized to achieve one or more stated purposes.' [ISO15288] Information systems are defined by the authorization boundary 8 , which for systems will encapsulate elements owned and operated by organizations. The information system can also be supported by other enabling systems, which will fall outside the authorization boundary. Information systems can also interact with other systems, which might be beneficiaries of capabilities offered by the information system. The system, as defined by the authorization boundary-as well as some enabling systems and other systems -will fall within the environment of operation, which is the physical environment in which these systems reside and operate. As explained in SP 800-37 Rev. 2, organizations define and determine the parts of the environment of operation that are within the authorization boundary of each federal system. Figure 1 shows how the environment of operation can contain multiple authorization boundaries, including other systems and enabling systems. Elements, including IoT devices, may interact and communicate across multiple systems/authorization boundaries. However, for accountability and risk management purposes, each IoT device is only included within one authorization boundary. 9 Additional enabling systems will fall outside of the environment of operation (e.g., a system hosted by another organization or service provider). This concept of systems and elements can help clarify the ways IoT devices might be used by organizations and the subsequent identification of device cybersecurity requirements. Some IoT devices should be characterized as an enabling or other system if the device is managed in a different authorization boundary than the organization's system. 10 An example of this type of other system might be a building or campus monitoring system that is primarily autonomous.

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.12 (NIST 3.6.12)?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

3.6.12. 3.6.12. 3.6.12.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N provide? (Part 4)

[Assistant]
tandards with similar goals and objectives. An objective of both is to provide a standardized way for expressing and enforcing vastly diverse access control policies on various types of data services.
However, the two standards differ with respect to the manner in which access control policies are specified and implemented. This document describes XACML and NGAC, and then compares them with respect to five criteria. The goal of this publication is to help ABAC users and vendors make informed decisions when addressing future data service policy enforcement requirements. ## Keywords

access control; access control mechanism; access control model; access control policy; attribute based access control (ABAC); authorization; Extensible Access Control Markup Language (XACML); Next Generation Access Control (NGAC); privilege

## Acknowledgements

The authors, David Ferraiolo, Ramaswamy Chandramouli, Vincent C. Hu, and Rick Kuhn of the National Institute of Standards and Technology (NIST), wish to thank their colleagues who reviewed drafts of this document, including the following: Karen Scarfone (Scarfone Cybersecurity), Wayne Jansen (Bayview Behavioral Consulting), Serban Gavrila (NIST), Indrakshi Ray (Colorado State University), Duminda Wijesekera (George Mason University), and Ram Krishnan (University of Texas at San Antonio). The authors also gratefully acknowledge and appreciate the comments and contributions made by government agencies, private organizations, and individuals in providing direction and assistance in the development of this document. ## Note to Readers

For purposes of transparency, one of the authors of this document, David Ferraiolo, is a member of the American National Standards Institute/International Committee for Information Technology (ANSI/INCITS) Next Generation Access Control (NGAC) working group.

A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

that blend station, electricity, and vehicle charging sales together. Third parties are individuals or entities that facilitate transactions but are not one of the primary parties within the exchange.
The EV/XFC ecosystem typically uses cloud service providers for these transactions because they are suitable for sensitive data exchanges that involve financial information, personally identifiable information (PII), and other potentially sensitive data. - Utilities/Building Systems . Utilities provide the power necessary to fuel the EV/XFC ecosystem. Building and facility management systems may be present in installations where energy management is required, such as EVSE installed at shopping centers, as well as where distributed energy resources (DER) may be present or where physical security control is required. Both utilities and building/facility management systems include equipment to monitor power utilization, communicate with networked devices and supervisory systems, and help control on-site energy demands.

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs:

many other rules like the one above in the knowledge base. All the rules form a Datalog program, and a Prolog system can efficiently evaluate  such  a  program  against  thousands  of  input  tuples.
The  evaluation  process  will  find  out all consequences arising from these rules. Complex multistep, multi-host attack paths are naturally captured in this logical reasoning process, even though each rule itself only describes a specific type of attack.

Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Program Review for Information Security Management Assistance (PRISMA) provide? (Part 3)

[Assistant]
thank the many people who assisted with the development of this handbook. NIST management officials who supported this effort include: Joan Hash, William C. Barker, Elizabeth Chew, and Matthew Scholl.
The authors would like to thank Matthew Scholl, and Craig Russell who assisted with reviewing this document and provided comments and suggestions for improvement. In addition, special thanks are due those contractors who helped craft the PRISMA NISTIR, prepare drafts, and review materials:

Jessica Gulick of Science Applications International Corporation, (SAIC) served as Project Manager for SAIC on this project. In addition, many SAIC and System 1, Inc. employees contributed to the PRISMA NISTIR, including: Jim Fahlsing, SAIC, Steve Batdorff, System 1, Inc.,Charles M. Cramer, Jr., SAIC, John Abeles, System 1, Inc.,Steve Senz, System 1, Inc.,Michael Pheil, SAIC, Anjali Mulchandani, SAIC, and Rich Sella, SAIC. Special thanks to SAIC's Jessica Gulick, Amy Palmer, and Michael Pheil for their diligent review and editorial support of this document. For all the hard work on the PRISMA database, the authors would like to thank Charles M. Cramer, Jr, Steve Batdorff, and Michael Pheil. In memory of Charles M. Cramer, Jr. Semper Fi

The authors also gratefully acknowledge and appreciate the many contributions from individuals in the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## This page is intentionally blank

## T A B L E   O F   C O N T E N T S

| 1.

Program Review for Information Security Management Assistance (PRISMA)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

3.2.1. 3.2.1. 3.2.1.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

..................................................................... | Introduction ...................................................................................................................
| 1-1  |
| 1.2                                                                                | Authority.................................................................................................................1-1 Scope................................................................................................1-1 | Authority.................................................................................................................1-1 Scope................................................................................................1-1 |      |
| 1.3                                                                                | Purpose and Audience ................................................................................................................1-1                                                                                | Purpose and Audience ................................................................................................................1-1                                                                                |      |
| 1.4                                                                                |                                                                                |                                                                                |      |
| 2.

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0:

ion understands its dependencies and partners and receives information from these partners that enables collaboration and risk-based management decisions within the organization in response to events.
| Function      | Category                                                                                | Subcategory                                                                                | Informative References                                                                                |
|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| IDENTIFY (ID) | Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization's risk strategy.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

ing, implementing, maintaining, and improving information security management of the organization. It is a documented set of the organization's security policies, procedures, guidelines and standards.
The program is intended to protect the confidentiality, integrity and availability of information resources.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does FIPS 140-3 Derived Test Requirements (DTR)_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 3)

[Assistant]
raft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sp800-140-comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

NIST Special Publication (SP) 800-140 specifies the modifications of the Derived Test Requirements (DTR) for Federal Information Processing Standard (FIPS) 140-3. SP 800-140 modifies the test (TE) and vendor (VE) evidence requirements of International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 24759.

FIPS 140-3 Derived Test Requirements (DTR)_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Representation of PIV Chain-of-Trust for Import and Export provide? (Part 3)

[Assistant]
may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at http://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: piv\_comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to  advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the  cost-effective  security  and  privacy  of  other  than  national  security-related  information  in federal  information  systems. The  Special  Publication  800-series  reports  on  ITL's  research, guidelines,  and  outreach  efforts  in  information  system  security,  and  its  collaborative  activities with industry, government, and academic organizations. ## Abstract

This document provides a common XML-based data representation of a chain-of-trust record to facilitate the exchange of Personal Identity Verification (PIV) Card enrollment data.

Representation of PIV Chain-of-Trust for Import and Export


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Dr. Arnold joined the National Institute of Standards and Technology (NIST) in September 2006 as Deputy Director, Technology Services, after a 33-year career in the telecommunications and information technology industry. He was appointed National Coordinator for Smart Grid Interoperability at in April 2009. He has been responsible for leading the development of standards underpinning the nation's Smart Grid. In October 2011, Dr. Arnold added an additional role as Director of Cyber Physical Systems within NIST's Engineering Laboratory (EL).

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ Methods for Format-Preserving Encryption:

Methods for Format -Preserving Encryption

Methods for Format-Preserving Encryption

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: encryptionmodes@nist.gov

Recommendation for Block Cipher Modes of Operation_ Methods for Format-Preserving Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Trustworthy Email:

3.1.2                                                                                | Unauthorized Email Receiver within an Organization's IP Address Block... 3.1.2 Unauthorized Email Receiver within an Organization's IP Address Block

Unauthorized mail receivers are a risk to the enterprise IT security posture because they may be an entry point for malicious email. 3.1.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guidelines for Media Sanitization:

## Guidelines for Media Sanitization

## Guidelines for Media Sanitization

Chandramouli R, Hibbard EA (2025) Guidelines for Media Sanitization. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-88r2. https://doi.org/10.6028/NIST.SP.800-88r2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

3.5.1. 3.5.1. 3.5.1.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guidelines for Securing Radio Frequency Identification (RFID) Systems:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1   |
|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Guidelines for Securing Radio Frequency Identification (RFID) Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions provide? (Part 2)

[Assistant]
HA-3  family  consists  of  four  cryptographic  hash  functions,  called  SHA3-224, SHA3-256,  SHA3-384,  and  SHA3-512,  and  two  extendable-output  functions  (XOFs), called SHAKE128 and SHAKE256.
Hash  functions  are  components  for  many  important  information  security  applications, including 1) the generation and verification of digital signatures, 2) key derivation, and 3) pseudorandom bit generation. The hash functions specified in this Standard supplement the SHA-1 hash function and the SHA-2 family of hash functions that are specified in FIPS 180-4, the Secure Hash Standard. Extendable-output functions are different  from hash functions, but it is possible to use them in similar ways, with the flexibility to be  adapted directly to the requirements of individual applications, subject to additional security considerations. Key  words : computer security, cryptography, extendable-output function, Federal Information  Processing  Standard,  hash  algorithm,  hash  function,  information  security, KECCAK,  message  digest,  permutation,  SHA-3,  sponge  construction,  sponge  function, XOF. ## Federal Information Processing Standards Publication 202

## August 2015

## Announcing the

## SHA-3 STANDARD:  PERMUTATION-BASED HASH AND EXTENDABLE OUTPUT FUNCTIONS

Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National Institute  of  Standards  and  Technology  (NIST)  after  approval  by  the  Secretary  of  Commerce pursuant  to  Section  5131  of  the  Information  Technology  Management  Reform  Act  of  1996 (Public Law 104-106), and the Computer Security Act of 1987 (Public Law 100-235). 1. Name  of  Standard :  SHA-3  Standard:  Permutation-Based  Hash  and  Extendable-Output Functions (FIPS PUB 202). 2. Category of Standard : Computer Security Standard, Cryptography. 3. Explanation :  This  Standard  (FIPS  202)  specifies  the  Secure  Hash  Algorithm-3  (SHA-3) family of functions on binary data.

SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Cybersecurity Framework Profile for Liquefied Natural Gas:

| Table 17. Summary Table of Mission Objectives with Protect Function Category Priorities...... | 22                                                                                |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 18. Summary Table of Mission Objectives with Detect Function Category Priorities....... | 23                                                                                |
| Table 19. Summary Table of Mission Objectives with Respond Function Category Priorities... | 23                                                                                |
| Table 20. Summary Table of Mission Objectives with Recover Function Category Priorities.... | 23                                                                                |
| Table 21. CSF Subcategory Priorities for the Identify Function's Asset Management (ID.AM)                                                                                | Category........................................................................................................................................23 |
| Table 22.

Cybersecurity Framework Profile for Liquefied Natural Gas


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to U.S. Department of Energy Risk Assessment Methodology:

- Sensitive information disclosed when computer operator forgets to lock the computer facility at end of the day.
- Computer supplies destroyed when employee stores them in a damp area.
- Computer facility damaged when maintenance personnel accidentally set off Halon fire suppression system.
- Building becomes inaccessible when a toxic gas is released.

- Peripheral equipment damaged by disk head crash
- Storage media destroyed by accidentally spilling coffee on the media
- Classified information disclosed through release of malfunctioning storage media to maintenance personnel prior to degaussing
- Use of hardware denied because operator failed to follow proper start-up procedures.

- Documentation is damaged because of extreme humidity.
- Routine maintenance checks of sprinkler system are neglected after staff reductions occur, leading to a costly repair.

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Computer Security Division 2005 Annual Report:

| Welcome Letter                                      | 1   |
|-----------------------------------------------------|-----|
| Division Organization                               | 2   |
| The Computer Security Division Responds to the      |     |
| Federal Information Security Management Act of 2002 | 3   |
| Outreach, Awareness, and Education                  | 4   |
| Security Management and Guidance                    | 9   |
| Security Testing and Metrics                        | 16  |
| Security Research and Emerging Technologies         | 21  |
| Cryptographic Standards and Applications            | 36  |
| Honors and Awards                                   | 44  |
| Computer Security Division Publications - 2004      | 46  |
| Ways to Engage Our Division and NIST                | 48  |

Security Testing & Metrics Group

- Methods for assessing effectiveness of security  requirements -  SP  800-53A, Guide for Assessing the Security Controls in Federal Information Systems (first public draft issued July 2005). - Procedures  for  capturing  results  of security  requirement  assessments  and results of security program assessments - SP 800-26 Revision 1, Guide for Information  Security  Program  Assessments  and System  Reporting  Form (first  public  draft issued August 2005). - Bring  the  security  planning  process  up to  date  with  key  standards  and  guidelines  developed  by  NIST -  SP  800-18 Revision 1, Guide for Developing Security Plans  for  Federal  Information  Systems (first public draft issued August 2005).

Computer Security Division 2005 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

There may be references in this publication to other publications currently under development by NIST in accordance  with  its  assigned  statutory  responsibilities. The  information  in  this  publication,  including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where  they  exist,  remain  operative. For  planning  and  transition  purposes,  federal  agencies  may  wish  to closely follow the development of new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal systems. The authors, Kelley Dempsey of the National Institute of Standards and Technology (NIST), Dr. George Moore of the Applied Physics Laboratory at Johns Hopkins University, and Paul Eavy of the Department of Homeland Security, wish to thank their colleagues who reviewed drafts of this document, including Nadya Bartol, Craig Chase, Ann Dixon, Terry Fletcher, Jim Foti, Susan Hansche, Amy Heydman, Alicia Jones, Betsy Kulick, Elizabeth Lennon, Susan Pagan, Daniel Portwood, Ron Ross, Martin Stanley, Kevin Stine, Robin Walker, David Waltermire, Kimberly Watson, and Jim Wiggins.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Part 5)

[Assistant]
quirements in NIST Special Publication 800-171 and are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations.
## Keywords

Advanced Persistent Threat; Basic Security Requirement; Contractor Systems; Controlled Unclassified Information; CUI Registry; Derived Security Requirement; Enhanced Security Requirement; Executive Order 13556; FIPS Publication 199; FIPS Publication 200; FISMA; NIST Special Publication 800-53; Nonfederal Organizations; Nonfederal Systems; Security Assessment; Security Control; Security Requirement. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Acknowledgements

The authors also wish to recognize the scientists, engineers, and research staff from the NIST Computer Security and the Applied Cybersecurity Divisions for their exceptional contributions in helping to improve the content of the publication. A special note of thanks to Pat O'Reilly, Jim Foti, Jeff Brewer, Chris Enloe, Ned Goren, and the entire NIST web team for their outstanding administrative support. Finally, the authors also gratefully acknowledge the contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms:

y infrastructure (PKI) that is responsible for issuing certificates to certificate subjects and exacting compliance to a PKI policy. |
| Ciphertext                        | Data in its encrypted form.
|
| Compromise                        | The unauthorized disclosure, modification, substitution, or use of sensitive data (e.g., a secret key, private key, or secret metadata). |
| Confidentiality                   | The property that sensitive information is not disclosed to unauthorized entities (i.e., the secrecy of key information is maintained). |
| Cross-certify                     | The establishment of a trust relationship between two Certification Authorities (CAs) through the signing of each other's public key in certificates; referred to as a 'cross- certificate.'                                               |
| Cryptographic algorithm           | A well-defined computational procedure that takes variable inputs, including a cryptographic key (if applicable), and produces an output. |
| Cryptographic boundary            | An explicitly defined continuous perimeter that establishes the physical bounds of a cryptographic module and contains all the hardware, software, and/or firmware components of a cryptographic module. |
| Cryptographic checksum            | A mathematical value created using a cryptographic algorithm that is assigned to data and later used to test the data to verify that the data has not changed. |
| Cryptographic hash function       | A function that maps a bit string of arbitrary length to a fixed- length bit string. Approved hash functions satisfy the following properties:                                                                                |

Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) provide? (Part 5)

[Assistant]
umed by one or more authorized individuals when managing and using cryptographic key management services are collectively called a Cryptographic Key Management System (CKMS). This  Profile  for  U. S.
Federal  Cryptographic  Key  Management  Systems  (FCKMSs)  has  been prepared to assist CKMS designers and implementers in selecting the features to be provided in their  'products,'  and  to  assist  federal  organizations  and  their  contractors  when  procuring, installing, configuring, operating, and using FCKMSs. Other organizations may use this Profile as desired. An FCKMS can be owned and operated by a federal organization or by a private contractor that provides  key  management  services  for  federal  organizations  or  other  contractors  performing federal information-processing services. This Profile can also be used by agencies and organizations to understand their FCKMSs, and to adopt,  adapt  and  migrate  their  FCKMSs  to  comply  with  the  Profile  requirements  over  time. NIST  does  not  expect  that  these  requirements  would  be  implemented  immediately,  but  that agencies would use these requirements when creating or procuring FCKMSs or FCKMS services for their Enterprise Architectures. This  Profile  is  based  on  NIST  Special  Publication  800-130, A  Framework  for  Designing Cryptographic  Key  Management  Systems . The  Framework  specifies  topics  that  should  be considered by a CKMS designer when selecting the capabilities that a CKMS will have and the cryptographic  key  management  services  it  will  support. This  Profile  replicates  all  of  the Framework requirements that must be satisfied in a CKMS and its design documentation, and includes  additional  information  about  installing,  configuring,  operating  and  maintaining  an FCKMS.

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

Several researchers, including Page, Heaney, Adkins, and Dolsen of Planning Research Corporation^ and Abrams, LaPadula, Eggers and Olsen of MITRE^ , have been exploring Rule-Based access control policies. The Rule-Based concept permits security policies to be implemented as sets of rules, and modified as needed without modifying the architecture of the secure system. This promising approach

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Computer Security Division 2005 Annual Report provide?

[Assistant]
<!-- image -->

## TABLE OF CONTENTS

| Welcome Letter                                      | 1   |
|-----------------------------------------------------|-----|
| Division Organization                               | 2   |
| The Computer Security Division Responds to the      |     |
| Federal Information Security Management Act of 2002 | 3   |
| Outreach, Awareness, and Education                  | 4   |
| Security Management and Guidance                    | 9   |
| Security Testing and Metrics                        | 16  |
| Security Research and Emerging Technologies         | 21  |
| Cryptographic Standards and Applications            | 36  |
| Honors and Awards                                   | 44  |
| Computer Security Division Publications - 2004      | 46  |
| Ways to Engage Our Division and NIST                | 48  |

<!-- image -->

T his  year  the  Computer  Security Division  (CSD)  continued  its  efforts to improve information system security. This  effort  was  accomplished  through  raising  awareness of  information  technology  risks, vulnerabilities, and  protection  requirements-particularly  for new and emerging technologies. We continued to research, study, advise Agencies of IT vulnerabilities, and devise techniques for the cost-effective  security  and  privacy  of  sensitive  Federal systems. We  continued  to  develop  standards, metrics, tests, and validation programs to promote, measure, and  validate  security  in systems  and  services. We  also  developed guidance to increase secure IT planning, implementation, management, and  operation. This effort was conducted to assist our everexpanding  customer  base  that  now  includes federal, state, and local governments, the healthcare community, colleges and universities, small businesses, the  private  sector, and  the  international community.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Awareness and Training?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.6.

4.3.6. Verification Requirements . . . . . . . . . . . . . . . . . . . . .

3.6. Redress Requirements

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop support CMMC certification?

[Assistant]
According to Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop:

es  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000 Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

This report summarizes the feedback received on the work of the NIST Cybersecurity for IoT program on device cybersecurity at a virtual workshop in July 2020.

Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to An Industrial Control System Cybersecurity Performance Testbed:

3.5.2                                                                                | 3. 3.5.2 Ixia Traffic Generator

The Ixia M2 can be leveraged for executing denial of service (DoS) and replay attacks on the simulated networks.

An Industrial Control System Cybersecurity Performance Testbed


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

When planning security, it is essential to first define the threats that must be mitigated. Organizations that use checklists should conduct risk assessments to identify the specific threats against their systems and determine the effectiveness of existing security controls in counteracting the threats; they then should perform risk mitigation to decide what additional measures (if any) should be implemented, as discussed in NIST SP 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach [6]. Performing risk assessments and mitigation helps organizations better understand their needs and decide whether or not they need to modify or enhance selected checklists.

National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Guidelines for Securing Radio Frequency Identification (RFID) Systems:

3.3.4 provides more information on tamper protection. 3.3.4. 3.3.4 Tamper Resistance

Control: Certain RFID tags have tamper resistant or tamper-evident features that help prevent an adversary from altering the tags or removing them from the objects to which they are attached.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.10 (NIST 3.3.10)?

[Assistant]
According to Guide to Operational Technology (OT) Security:

3.3.10. 3.3.10. 3.3.10.

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Audit and Accountability?

[Assistant]
According to Fiscal Year 2021 Cybersecurity and Privacy Annual Report:

A series of 'case studies' was created to enable a small business to educate its employees about common cybersecurity risks. Each case study is limited to a single printable page and is designed to provide sufficient information to allow a discussion of the topic's relevance to the organization. The topics include phishing, social engineering, keystroke logging, encryption, and data breaches.

With the publication of the third set of conformance criteria for Federation and Assertions (SP 800-63C), following on the release of conformance criteria for volumes SP 800-63A and SP 800-63B in June 2020, the full set of conformance criteria for all volumes of SP 800-63-3 has been completed.  The conformance criteria present all normative requirements and controls for  the  SP  800-63A, B, and C and provide supplemental guidance, control objectives, and recommended test and conformance assessment methods for all of the normative requirements and controls at the designated assurance levels. The conformance criteria are used by federal agencies, independent assessment and certification bodies, auditors, and implementers so that all of the normative requirements and controls for SP 800-63-3 are understood for proper implementation, conformance assessment, and audit.

The Privacy-Enhancing Cryptography project promotes the use of cryptographic protocols that enable parties to interact meaningfully without revealing private information to one another or to third parties. Toward this end, NIST has been engaged with various stakeholders, researchers, and developers. In FY 2021, motivated by the need to conduct automated exposure notification related to the current pandemic, NIST developed a privacy-protecting method to measure levels of interaction within a population. NIST also launched a quarterly series of talks on topics related to privacy and public auditability.

Fiscal Year 2021 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

- A method to identify opportunities for improving the current cybersecurity posture of the manufacturing system
- An evaluation of their ability to operate the control environment at their acceptable risk level
- A standardized approach to preparing the cybersecurity plan for ongoing assurance of the manufacturing system's security

| Function   | Category             | Subcategory   | Manufacturing Profile Guidance                                                                                | Reference        |
|------------|----------------------|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
| IDENTIFY   | Supply Chain (ID.SC) | ID.SC-3       | Low Impact Implement contractual cybersecurity requirements for suppliers and third-party partners requiring access to sensitive information or providing information technology, operational technology, services, technology-based input products, or non-technology-based input products supporting the manufacturing system. Cyber supply chain risk assessment results should be used in the development of cybersecurity requirements.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Computer Security_ Selected Articles:

By grandfathering, you use a schedule that insures that you won't lose important data, even if you are hit by a virus. First, make a baseline backup so every file on the LAN is backed up. It is the basis you'll use if you must restore the entire system. Second, make daily backups, which you keep until the end of the week. At week's end, you do the weekly back up, which you keep for a month. Return the daily tapes to use for next week's backups.

Now, each month, do a monthly backup, which you keep for a year. Thus, you have four dailies. On Friday, you keep a weekly. At the end of the month, you have four weeklies. At the end of the year, you have 12 monthlies. And you always have the baseline backup. Only back up files that change (incremental backup). Then when you need to restore an entire drive, you start with the baseline and then update with the most recent incremental backup. If you find a virus in your backup, you can move to an earlier backup (that's why you grandfather) and the worst you'll have to do is reenter a month's worth of data.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4):

| Index   | Event                                                          | Ref        |
|---------|----------------------------------------------------------------|------------|
| SERI    | An improperly protected TPDU received shall be discarded.      | 6.0        |
| SER2    | A TPDU with an invalid key identifier shall be discarded.      | 6.2.3      |
| SER3    | A TPDU with an invalid ICV shall be discarded.                 | 6.3. 1.3   |
| SER4    | A TPDU with an invalid direction indicator shall be discarded. | 6.3.2.3    |
| SER5    | A TPDU with an improper label shall be discarded.              | 6.5.3      |
| SER6    | A TPDU with an improper pad shall be discarded.                | 6.2.3      |
| SER7    | A TPDU with a duplicate sequence number shall be discarded.    | 6.3.3. 1.2 |
| SERB    | A TPDU with an invalid peer address shall be discarded.        | 6.4        |

| Index   | Event                                                                                | Ref       | Action                       | Action    |
|---------|---------------------------------------------------------------------------------------------------------------------------------------|-----------|------------------------------|-----------|
|         |                                                                                |           | Allowed                      | Supported |
| SER9    | An invalid final sequence number detected for an encapsulated DR, DC, or ER TPDU.                                                     | 6.3.3.2.3 | Local Matter; Audit Advised. |           |
| SERIO   | An invalid destination address, inconsistent with that negotiated for the associated key identifier, appears on an encapsulated TPDU. | None      | Open                         |           |

Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759 provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Cryptographic Module Validation Program (CMVP)-Approved Security Functions_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

ning  and  enable  better  automation  of  security management  activities  like  configuration  control,  vulnerability  testing,  security  audits, and  security  patching  of  platform  components.
Information  assurance  and  security response activities also profit from a uniform, homogeneous cloud infrastructure, as do system  management  activities,  such  as  fault  management,  load  balancing,  and  system maintenance. Similarly,  infrastructure  homogeneity  benefits  management  controls employed to protect privacy. On the other hand, homogeneity means that a single flaw will be manifested throughout the cloud, potentially impacting all tenants and services. Many  cloud  computing  environments  meet  standards  for  operational  compliance  and certification in areas such as healthcare (e.g., Health Insurance Portability and Accountability  Act  (HIPAA)),  finance  (e.g.,  Payment  Card  Industry  Data  Security Standard  (PCI  DSS)),  security  (e.g.,  ISO  27001,  Information  Security  Management Systems  -  Requirements),    and  audit  (e.g.,  Standards  for  Attestation  Engagements (SSAE) No. 16), and may attain formal certification or attestation from an independent third party, to impart a level of assurance with regard to some recognized and generally accepted criteria. -  Resource Availability. The scalability of cloud computing facilities allows for greater availability. Redundancy  and  disaster recovery capabilities are built into cloud computing  environments  and  on-demand  resource  capacity  can  be  used  for  better resilience  when  faced  with  increased  service  demands  or  distributed  denial  of  service attacks,  and for quicker  recovery  from serious incidents. When an incident occurs, an opportunity  also  exists  to  contain  attacks  and  capture  event  information  more  readily, with greater detail and less impact on production.

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Security Property Verification by Transition Model:

(2016) NPTEL National Program on Technology Enhanced learning . Available at https://www.youtube.com/watch?v=\_2E5Q3CZ7g4&t=56s [YC2] CTL (2016) National Program on Technology Enhanced learning .
Available at https://www.youtube.com/watch?v=Blh060Hgbm8 [ZL] Potter B, Sinclair J, Till D (1996) An Introduction to Formal Specification and Z (Prentice Hall PTR, Upper Saddle River, NJ), 2nd Ed. Available at https://dl.acm.org/doi/10.5555/547639

Security Property Verification by Transition Model


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does An Industrial Control System Cybersecurity Performance Testbed provide? (Part 5)

[Assistant]
| Traffic Manipulation Tools for Linux ............................................................................................18               |
|------------|---------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. | Categories of Industrial Processes ...............................................................................................19              |
| Table 3. | List of Terms .................................................................................................................................23 |
| Table 4. | Performance Metrics for Continuous Processes..........................................................................26                          |
| Table 5. | Performance Metrics for Discrete Processes...............................................................................26                       |
| Table 6. | Metrics for Measuring System Performance ...............................................................................27                        |
| Table 7. | Nominal System Properties for Measuring System Performance................................................27                                      |
| Table 8. | Metrics for Measuring Network Performance.............................................................................28                          |
| Table 9. | ISA/IEC-62443-3-3 Requirements to Security Level Mapping......................................................29                                  |
| Table 10. | Metrics Types Collected from the TE Simulation .......................................................................35                          |
| Table 11. | Listing of the METRICS Table in the Results Database...............................................................36                             |

## Table of Figures

| Figure 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

3.2.1, Appendix F. 3.2.11                                                                                |
| DP-3: Detection processes are tested. 3.2.1, CP-2, CP-3, IR-3, IR-8 NIST SP 800-53 Rev.

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Using Business Impact Analysis to Inform Risk Prioritization and Response:

The use of a common methodology also supports enterprise communication and collaboration to better understand what constitutes sensitivity and criticality in each enterprise's unique context. An example of such a methodology is described in the Criticality Analysis Process Model [NISTIR8179]. This model includes top-down and bottom-up analyses that connect different levels of the enterprise to support consistent and comprehensive assessments. NIST IR 8179 uses the term 'baseline criticality . ' These concepts are used in Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations , NIST Special Publication (SP) 800161 Revision 1 [SP800-161R1], and defined as,

| Publication Identifier   | Date       | Type of Edit   | Change                                                                                | Location           |
|--------------------------|------------|----------------|-------------------------------------------------------------------------------------------------------------------------------------|--------------------|
| NIST IR 8286D-upd1       | 02/26/2025 | Editorial      | Added NIST IR 8286D to the list of IR 8286 series publications                                                                      | Sec. 1 (p. 3)      |
| NIST IR 8286D-upd1       | 02/26/2025 | Editorial      | Updated quotes from NIST IR 8286A to reflect the content of NIST IR 8286Ar1-ipd                                                     | Sec. 1 (p. 4)      |
| NIST IR 8286D-upd1       | 02/26/2025 | Editorial      | Added reference to the new change log                                                                                | Sec. 1.3 (p. 5)    |
| NIST IR 8286D-upd1       | 02/26/2025 | Editorial      | Updated footnote 8 to specify the correct section number from NIST IR 8286C r1-ipd                                                  | Sec. 2.2 (p.

Using Business Impact Analysis to Inform Risk Prioritization and Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Security and Privacy Controls for Information Systems and Organizations:

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim
Foti, and the NIST web team for their outstanding administrative support. The authors also wish
to recognize Kristen Baldwin, Carol Bales, John Bazile, Jennifer Besceglie, Sean Brooks, Ruth
Cannatti, Kathleen Coupe, Keesha Crosby, Charles Cutshall, Ja’Nelle DeVore, Jennifer Fabius, Jim
Fenton, Hildy Ferraiolo, Ryan Galluzzo, Robin Gandhi, Mike Garcia, Paul Grassi, Marc Groman,
Matthew Halstead, Kevin Herms, Scott Hill, Ralph Jones, Martin Kihiko, Raquel Leone, Jason
Marsico, Kirsten Moncada, Ellen Nadeau, Elaine Newton, Michael Nieles, Michael Nussdorfer,
Taylor Roberts, Jasmeet Seehra, Joe Stuntz, Jeff Williams, the professional staff from the NIST
Computer Security Division and Applied Cybersecurity Division, and the representatives from
the Federal CIO Council, Federal CISO Council, Federal Privacy Council, Control Baseline
Interagency Working Group, Security and Privacy Collaboration Working Group, and Federal
Privacy Council Risk Management Subcommittee for their ongoing contributions in helping to
improve the content of the publication. Finally, the authors gratefully acknowledge the
contributions from individuals and organizations in the public and private sectors, both
nationally and internationally, whose insightful and constructive comments improved the
overall quality, thoroughness, and usefulness of this publication. CONTROL BASELINES

The control baselines that have previously been included in NIST Special Publication 800-53 have
been relocated to NIST Special Publication 800-53B. SP 800-53B contains security and privacy
control  baselines  for  federal  information  systems  and  organizations. It provides  guidance  for
tailoring  control  baselines  and  for  developing  overlays  to  support  the  security  and  privacy
requirements of stakeholders and their organizations.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Risk Management for Replication Devices:

Inspect the device for defects, delivery errors (e.g., wrong version), and malware before accepting delivery. Once acquired, include networked/wireless RDs and those with nonvolatile storage in the associated system security plan. Document device information, supply chain (e.g., distributer) information, default and customized configuration settings, security/usage policies, and any other information related to the acquisition and security requirements of the device.

National Institute of Standards and Technology, Special Publication 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations . http://csrc.nist.gov/publications/drafts/800161/sp800\_161\_2nd\_draft.pdf


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations provide? (Part 4)

[Assistant]
to review all draft publications during public comment periods and provide feedback to NIST. All NIST publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.
National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Electronic mail: 800-137comments@nist.gov

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Acknowledgements

The authors, Kelley Dempsey, Arnold Johnson, Matthew Scholl and Kevin Stine of the National Institute of Standards and Technology (NIST), Ronald Johnston of the Department of Defense Chief Information Officer, Defense-wide Information Assurance Program (DOD-CIO, DIAP), Alicia Clay Jones and Angela Orebaugh of Booz Allen Hamilton, and Nirali Shah Chawla of PricewaterhouseCoopers LLP (PwC), wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would like to acknowledge their colleagues for their keen and insightful assistance with technical issues throughout the development of the document. And finally, the authors gratefully acknowledge and appreciate the significant contributions from individuals and organizations in the public and private sectors whose thoughtful and constructive comments improved the overall quality and usefulness of this publication.

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to System and Network Security Acronyms and Abbreviations:

| automatic identification and data capture | | AIM | Association for Automatic Identification and Mobility | | AIT | automatic identification technology | | AJAX | Asynchronous JavaScript and XML | | AK | authorization key | | AKID | authorization key identifier | | AKM | authentication and key management | | ALG | application layer gateway | | ANSI | American National Standards Institute | | AP | access point | | API | application programming interface |

System and Network Security Acronyms and Abbreviations